All vulnerabilities
CVE-2026-97531

Linux: scsi: qla2xxx: Skip vport under deletion in report ID acquisition

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in40dcd4a71a52414b47fbba2f956387f1077c6c15Also 20bb54601d2655e83795b73499c89f6b1cb31016, 7a83979d92782f83c90888ebe19bdc9420521940 and 1 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 40dcd4a71a52414b47fbba2f956387f1077c6c15LinuxCVE List
  • 20bb54601d2655e83795b73499c89f6b1cb31016LinuxCVE List
  • 7a83979d92782f83c90888ebe19bdc9420521940LinuxCVE List
  • 23582731afa35031c94fadb71a4f3b4afd094649LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Skip vport under deletion in report ID acquisition

qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under vport_slock, takes a vref_count on the matching vport and calls qla_update_host_map() to register its port id.

A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then qla24xx_disable_vp() removes the vport from the host_map btree and zeroes vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later, in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX) but does not touch host_map. In the window in between, report ID acquisition can still find the vport on vp_list and call qla_update_host_map(); with d_id already zeroed it takes the btree_insert32() path and re-inserts the dying vport into host_map. Nothing cleans that entry afterwards, so once scsi_host_put() frees the vha a later host_map lookup dereferences freed memory.

Skip a vport that has VPORT_DELETE set before taking the reference, so it is neither re-registered nor scheduled for DPC re-registration. This mirrors the existing guard in qla2x00_alert_all_vps().

Text from CVE List

Affected versions 12

  • Linuxaffected: 41dc529a4602ac737020f423f84686a81de38e6d before 40dcd4a71a52414b47fbba2f956387f1077c6c15CVE List
  • Linuxaffected: 41dc529a4602ac737020f423f84686a81de38e6d before 20bb54601d2655e83795b73499c89f6b1cb31016CVE List
  • Linuxaffected: 41dc529a4602ac737020f423f84686a81de38e6d before d61e8de98c5a52978fb1edd95fe4dde3131b280eCVE List
  • Linuxaffected: 41dc529a4602ac737020f423f84686a81de38e6d before 7a83979d92782f83c90888ebe19bdc9420521940CVE List
  • Linuxaffected: 41dc529a4602ac737020f423f84686a81de38e6d before 23582731afa35031c94fadb71a4f3b4afd094649CVE List
  • Linuxaffected: 4.11CVE List
  • Linuxunaffected: all versions before 4.11CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5